0sec-cli 0.25.0 → 0.26.0

package/chunks/{chunk-3HMO42M2.js → chunk-MOGWEHSC.js}

@@ -10,15 +10,17 @@ import {
   createLocalConsoleSession,
   findingFromRow,
   loadFindingFocus
-} from "./chunk-BWUW6ZQR.js";
+} from "./chunk-UQS7XCBV.js";
 import {
   assertLocalEngineAvailable,
   registerLocalEngine
-} from "./chunk-DMDWIW3E.js";
+} from "./chunk-Z2VLJEQJ.js";
 import {
   WebOperatorServices,
-  createSessionPluginHostManager
-} from "./chunk-EQBC2ZWL.js";
+  createRemoteJWKSet,
+  createSessionPluginHostManager,
+  jwtVerify
+} from "./chunk-ZPVSDB63.js";
 import {
   BackendConnectionRegistry,
   backendBearerFromEnv,
@@ -26,7 +28,7 @@ import {
   handleBackendConnectionRequest,
   loadManagedWorker,
   validateWorkerOptions
-} from "./chunk-SEWZ76MN.js";
+} from "./chunk-UGCTPKJG.js";
 import {
   Option,
   presentationEventBus
@@ -56,13 +58,13 @@ import {
   validateWorkbenchSourceLesson,
   workbenchConfigPath,
   workbenchNetworkEnabled
-} from "./chunk-6TA3CWND.js";
+} from "./chunk-V2KJQVYE.js";
 import {
   connectServicePlugins,
   createConsoleRuntime,
   exportReport,
   isReportExportFormat
-} from "./chunk-EEP6GBUO.js";
+} from "./chunk-3MWQNNJU.js";
 import {
   HuntMemoryStore,
   TOOL_DEFINITIONS,
@@ -73,7 +75,7 @@ import {
   readToolCallNames,
   subscribeBrowserView,
   validateAgentSkillContent
-} from "./chunk-HFUOUT2B.js";
+} from "./chunk-SIR7XW2S.js";
 import {
   SecurityWorkflowStore,
   WorkflowTriggerStore,
@@ -82,21 +84,21 @@ import {
   osecDB,
   resolveOsecDbPath,
   restoreFindingReviewFields
-} from "./chunk-YXTV2FRE.js";
+} from "./chunk-72PU46MS.js";
 import {
   LlmApiRuntime
-} from "./chunk-EIONVEFN.js";
+} from "./chunk-HS2NQ7K6.js";
 import {
   DEFAULT_WORKBENCH_BROKER_LIMITS,
   approveSmolvmWorkbenchImage,
   getSmolvmWorkbenchStatus,
   isAdmittedSmolvmWorkbench,
   resolveSmolvmRuntime
-} from "./chunk-3T5R7P4T.js";
+} from "./chunk-XOVYV7TT.js";
 import {
   ScopePolicy,
   withScopeEnforcement
-} from "./chunk-27SXCYWH.js";
+} from "./chunk-RZZ6VPRY.js";
 import {
   BackendDescriptorSchema,
   BackendRequestIdSchema,
@@ -105,7 +107,7 @@ import {
   VERSION,
   createPresentationEvent,
   homeStateDir
-} from "./chunk-S3B6HFSM.js";
+} from "./chunk-GYEYTNHK.js";
 import {
   external_exports
 } from "./chunk-5XOYTAOK.js";
@@ -242,6 +244,7 @@ async function runGuest(cli) {
       tools: session.tools,
       messages: session.messages,
       autonomyMode: session.autonomyMode,
+      webSearchEnabled: session.webSearchEnabled,
       target: session.target,
       scope: session.scope?.raw,
       localScopePath: session.localScopePath,
@@ -459,9 +462,16 @@ async function runGuest(cli) {
             turn = void 0;
             break;
           }
-          case "autonomy":
+          case "autonomy": {
+            if (typeof frame.value !== "string" || !["standard", "recon", "copilot", "yolo"].includes(frame.value)) throw new Error("Invalid autonomy mode");
             session.setAutonomyMode(frame.value);
             break;
+          }
+          case "webSearch": {
+            if (typeof frame.value !== "boolean") throw new Error("Invalid web search setting");
+            await session.setWebSearchEnabled(frame.value);
+            break;
+          }
           case "configure": {
             const value2 = frame.value;
             session.configureEngagement({ target: value2.target, ...value2.scope === void 0 ? {} : { scope: value2.scope ? new ScopePolicy(value2.scope) : null } });
@@ -765,8 +775,8 @@ function startManagedHostReconnect(options) {
 // packages/cli/src/web/local-provider-relay.ts
 async function createLocalRelayProvider(selection = {}, signal) {
   const [{ createWebConsoleRuntime }, { createWorkbenchProviderBroker }] = await Promise.all([
-    import("./operator-services-E2NONBQS.js"),
-    import("./dist-6RNAVFAY.js")
+    import("./operator-services-JOCREEBA.js"),
+    import("./dist-ONIRKDH6.js")
   ]);
   signal?.throwIfAborted();
   if (selection.providerId && selection.providerId !== "chatgpt-codex") throw new Error("Local model relay currently supports ChatGPT Codex only. Choose the local ChatGPT connection.");
@@ -864,11 +874,11 @@ function failureTransportStatus(error2, fallback) {
   return fallback;
 }
 function providerSseCompletion(maximumBytes = 8 * 1024 * 1024) {
-  const decoder2 = new TextDecoder();
+  const decoder = new TextDecoder();
   let buffer = "", completed = false;
   return (chunk) => {
     if (completed) return true;
-    buffer += decoder2.decode(chunk, { stream: true });
+    buffer += decoder.decode(chunk, { stream: true });
     let boundary;
     while (boundary = /\r?\n\r?\n/.exec(buffer)) {
       const block = buffer.slice(0, boundary.index);
@@ -899,15 +909,15 @@ async function createLocalProviderRelay(options) {
   const signal = options.signal ? AbortSignal.any([lifetime.signal, options.signal]) : lifetime.signal;
   signal.throwIfAborted();
   const peer = await options.registry.handshake(options.backendId);
-  const epoch2 = peer.handshake?.serverInstanceId;
-  if (peer.backend.status !== "connected" || !id(epoch2)) throw new Error("Provider relay requires a connected, identified host.");
+  const epoch = peer.handshake?.serverInstanceId;
+  if (peer.backend.status !== "connected" || !id(epoch)) throw new Error("Provider relay requires a connected, identified host.");
   const local = await (options.createProvider ?? createLocalRelayProvider)(options.selection ?? {}, signal);
   const base = "/api/console/provider-relays";
   let grant;
   try {
-    const response = await json(await options.registry.request(options.backendId, base, { method: "POST", body: { epoch: epoch2, provider: local.grant.provider, models: local.grant.models, model: local.info.model }, signal }));
+    const response = await json(await options.registry.request(options.backendId, base, { method: "POST", body: { epoch, provider: local.grant.provider, models: local.grant.models, model: local.info.model }, signal }));
     const candidate = object(response.grant);
-    if (!id(candidate.id) || candidate.epoch !== epoch2 || candidate.provider !== local.grant.provider || !Array.isArray(candidate.models) || candidate.models.length !== local.grant.models.length || new Set(candidate.models).size !== candidate.models.length || candidate.models.some((model) => typeof model !== "string" || !local.grant.models.includes(model)) || candidate.model !== local.info.model || typeof candidate.expiresAt !== "string" || !Number.isFinite(Date.parse(candidate.expiresAt))) throw new Error("Remote provider relay grant does not match the local approval.");
+    if (!id(candidate.id) || candidate.epoch !== epoch || candidate.provider !== local.grant.provider || !Array.isArray(candidate.models) || candidate.models.length !== local.grant.models.length || new Set(candidate.models).size !== candidate.models.length || candidate.models.some((model) => typeof model !== "string" || !local.grant.models.includes(model)) || candidate.model !== local.info.model || typeof candidate.expiresAt !== "string" || !Number.isFinite(Date.parse(candidate.expiresAt))) throw new Error("Remote provider relay grant does not match the local approval.");
     grant = candidate;
   } catch (error2) {
     await local.transport.close?.();
@@ -933,7 +943,7 @@ async function createLocalProviderRelay(options) {
     diagnostic.lastTransportStatus = response.status;
     return response;
   };
-  const send = (request, events, callerSignal) => remoteRequest(`${grantPath}/requests/${encodeURIComponent(request.requestId)}/events`, { method: "POST", body: { epoch: epoch2, sessionId: boundSession, events }, signal: callerSignal }).then(json);
+  const send = (request, events, callerSignal) => remoteRequest(`${grantPath}/requests/${encodeURIComponent(request.requestId)}/events`, { method: "POST", body: { epoch, sessionId: boundSession, events }, signal: callerSignal }).then(json);
   async function service(request) {
     const controller = new AbortController();
     active.set(request.requestId, controller);
@@ -1028,7 +1038,7 @@ async function createLocalProviderRelay(options) {
         diagnostic.phase = active.size ? "streaming" : "polling";
         diagnostic.lastPollAt = (/* @__PURE__ */ new Date()).toISOString();
         failureCategory = "scope_changed";
-        if (body.grantId !== grant.id || body.epoch !== epoch2 || body.sessionId !== void 0 && body.sessionId !== boundSession || !Array.isArray(body.requests) || !Array.isArray(body.cancelled) || body.requests.length > 4 || body.cancelled.length > 256) throw new Error("Remote provider relay scope changed.");
+        if (body.grantId !== grant.id || body.epoch !== epoch || body.sessionId !== void 0 && body.sessionId !== boundSession || !Array.isArray(body.requests) || !Array.isArray(body.cancelled) || body.requests.length > 4 || body.cancelled.length > 256) throw new Error("Remote provider relay scope changed.");
         for (const requestId of body.cancelled) {
           if (!id(requestId)) throw new Error("Invalid provider cancellation.");
           active.get(requestId)?.abort();
@@ -1036,7 +1046,7 @@ async function createLocalProviderRelay(options) {
         for (const value of body.requests) {
           const request = object(value);
           failureCategory = "request_rejected";
-          if (!id(request.requestId) || request.grantId !== grant.id || request.epoch !== epoch2 || request.sessionId !== boundSession || request.provider !== local.grant.provider || typeof request.model !== "string" || !local.grant.models.includes(request.model) || typeof request.body !== "string" || Buffer.byteLength(request.body) > local.grant.limits.maxRequestBytes) throw new Error("Remote provider request exceeds its approval.");
+          if (!id(request.requestId) || request.grantId !== grant.id || request.epoch !== epoch || request.sessionId !== boundSession || request.provider !== local.grant.provider || typeof request.model !== "string" || !local.grant.models.includes(request.model) || typeof request.body !== "string" || Buffer.byteLength(request.body) > local.grant.limits.maxRequestBytes) throw new Error("Remote provider request exceeds its approval.");
           if (seen.has(request.requestId)) continue;
           if (seen.size >= local.grant.limits.maxRequests || active.size >= Math.min(4, local.grant.limits.maxConcurrent)) throw new Error("Remote provider relay exceeded its request budget.");
           seen.add(request.requestId);
@@ -1091,8 +1101,8 @@ async function createLocalProviderRelay(options) {
 
 // packages/cli/src/web/local-provider-sessions.ts
 var LocalProviderSessionError = class extends Error {
-  constructor(message2, statusCode = 400) {
-    super(message2);
+  constructor(message, statusCode = 400) {
+    super(message);
     this.statusCode = statusCode;
   }
   statusCode;
@@ -1255,8 +1265,8 @@ var LocalProviderSessions = class {
 // packages/cli/src/web/remote-provider-relay.ts
 import { randomUUID as randomUUID2 } from "node:crypto";
 var ProviderRelayError = class extends Error {
-  constructor(message2, statusCode = 400) {
-    super(message2);
+  constructor(message, statusCode = 400) {
+    super(message);
     this.statusCode = statusCode;
   }
   statusCode;
@@ -1477,8 +1487,8 @@ async function handleRemoteProviderRelayRequest(req, res, url, broker, readBody)
 
 // packages/cli/src/web/report-artifacts.ts
 var ReportArtifactError = class extends Error {
-  constructor(message2, statusCode) {
-    super(message2);
+  constructor(message, statusCode) {
+    super(message);
     this.statusCode = statusCode;
   }
   statusCode;
@@ -1590,724 +1600,6 @@ import { join } from "node:path";
 import { readFileSync } from "node:fs";
 import { createHash, randomBytes, scrypt as scryptCallback, timingSafeEqual } from "node:crypto";
 import { promisify } from "node:util";
-
-// node_modules/.pnpm/jose@6.2.12/node_modules/jose/dist/webapi/lib/buffer_utils.js
-var encoder = new TextEncoder();
-var decoder = new TextDecoder();
-var strictDecoder = new TextDecoder("utf-8", { fatal: true });
-var MAX_INT32 = 2 ** 32;
-function concat(...buffers) {
-  const size = buffers.reduce((acc, { length }) => acc + length, 0), buf = new Uint8Array(size);
-  let i = 0;
-  for (const buffer of buffers)
-    buf.set(buffer, i), i += buffer.length;
-  return buf;
-}
-var NON_ASCII = /[^\x00-\x7f]/;
-function encode(string) {
-  if (typeof string == "string" && string.length >= 128) {
-    if (NON_ASCII.test(string))
-      throw new TypeError("non-ASCII string encountered in encode()");
-    return encoder.encode(string);
-  }
-  const bytes = new Uint8Array(string.length);
-  for (let i = 0; i < string.length; i++) {
-    const code = string.charCodeAt(i);
-    if (code > 127)
-      throw new TypeError("non-ASCII string encountered in encode()");
-    bytes[i] = code;
-  }
-  return bytes;
-}
-function decodeBase64(encoded, url = false) {
-  if (Uint8Array.fromBase64)
-    return Uint8Array.fromBase64(encoded, { alphabet: url ? "base64url" : "base64" });
-  if (url) {
-    if (encoded.includes("+") || encoded.includes("/"))
-      throw new TypeError("Invalid base64url");
-    encoded = encoded.replace(/-/g, "+").replace(/_/g, "/");
-  }
-  const binary = atob(encoded), bytes = new Uint8Array(binary.length);
-  for (let i = 0; i < binary.length; i++)
-    bytes[i] = binary.charCodeAt(i);
-  return bytes;
-}
-
-// node_modules/.pnpm/jose@6.2.12/node_modules/jose/dist/webapi/util/errors.js
-var JOSEError = class extends Error {
-  static code = "ERR_JOSE_GENERIC";
-  code = "ERR_JOSE_GENERIC";
-  constructor(message2, options) {
-    super(message2, options), this.name = this.constructor.name, Error.captureStackTrace?.(this, this.constructor);
-  }
-};
-var JWTClaimValidationFailed = class extends JOSEError {
-  static code = "ERR_JWT_CLAIM_VALIDATION_FAILED";
-  code = "ERR_JWT_CLAIM_VALIDATION_FAILED";
-  claim;
-  reason;
-  payload;
-  constructor(message2, payload, claim = "unspecified", reason = "unspecified") {
-    super(message2, { cause: { claim, reason, payload } }), this.claim = claim, this.reason = reason, this.payload = payload;
-  }
-};
-var JWTExpired = class extends JOSEError {
-  static code = "ERR_JWT_EXPIRED";
-  code = "ERR_JWT_EXPIRED";
-  claim;
-  reason;
-  payload;
-  constructor(message2, payload, claim = "unspecified", reason = "unspecified") {
-    super(message2, { cause: { claim, reason, payload } }), this.claim = claim, this.reason = reason, this.payload = payload;
-  }
-};
-var JOSEAlgNotAllowed = class extends JOSEError {
-  static code = "ERR_JOSE_ALG_NOT_ALLOWED";
-  code = "ERR_JOSE_ALG_NOT_ALLOWED";
-};
-var JOSENotSupported = class extends JOSEError {
-  static code = "ERR_JOSE_NOT_SUPPORTED";
-  code = "ERR_JOSE_NOT_SUPPORTED";
-};
-var JWSInvalid = class extends JOSEError {
-  static code = "ERR_JWS_INVALID";
-  code = "ERR_JWS_INVALID";
-};
-var JWTInvalid = class extends JOSEError {
-  static code = "ERR_JWT_INVALID";
-  code = "ERR_JWT_INVALID";
-};
-var JWKSInvalid = class extends JOSEError {
-  static code = "ERR_JWKS_INVALID";
-  code = "ERR_JWKS_INVALID";
-};
-var JWKSNoMatchingKey = class extends JOSEError {
-  static code = "ERR_JWKS_NO_MATCHING_KEY";
-  code = "ERR_JWKS_NO_MATCHING_KEY";
-  constructor(message2 = "no applicable key found in the JSON Web Key Set", options) {
-    super(message2, options);
-  }
-};
-var JWKSMultipleMatchingKeys = class extends JOSEError {
-  [Symbol.asyncIterator] = async function* () {
-  };
-  static code = "ERR_JWKS_MULTIPLE_MATCHING_KEYS";
-  code = "ERR_JWKS_MULTIPLE_MATCHING_KEYS";
-  constructor(message2 = "multiple matching keys found in the JSON Web Key Set", options) {
-    super(message2, options);
-  }
-};
-var JWKSTimeout = class extends JOSEError {
-  static code = "ERR_JWKS_TIMEOUT";
-  code = "ERR_JWKS_TIMEOUT";
-  constructor(message2 = "request timed out", options) {
-    super(message2, options);
-  }
-};
-var JWSSignatureVerificationFailed = class extends JOSEError {
-  static code = "ERR_JWS_SIGNATURE_VERIFICATION_FAILED";
-  code = "ERR_JWS_SIGNATURE_VERIFICATION_FAILED";
-  constructor(message2 = "signature verification failed", options) {
-    super(message2, options);
-  }
-};
-
-// node_modules/.pnpm/jose@6.2.12/node_modules/jose/dist/webapi/util/base64url.js
-var invalid = "The input to be decoded is not correctly encoded.";
-function decode(input) {
-  try {
-    return decodeBase64(typeof input == "string" ? input : decoder.decode(input), true);
-  } catch (cause) {
-    throw new TypeError(invalid, { cause });
-  }
-}
-
-// node_modules/.pnpm/jose@6.2.12/node_modules/jose/dist/webapi/lib/validate.js
-function isObject(input) {
-  if (typeof input != "object" || input === null || Object.prototype.toString.call(input) !== "[object Object]")
-    return false;
-  const prototype = Object.getPrototypeOf(input);
-  return prototype === null || Object.getPrototypeOf(prototype) === null;
-}
-function isJwkSet(input) {
-  return isObject(input) && Array.isArray(input.keys) && Array.from(input.keys).every(isObject);
-}
-function isDisjoint(...headers) {
-  const parameters = /* @__PURE__ */ new Set();
-  for (const header of headers)
-    if (header)
-      for (const parameter of Object.keys(header)) {
-        if (parameters.has(parameter))
-          return false;
-        parameters.add(parameter);
-      }
-  return true;
-}
-function decodeBase64url(value, label, ErrorClass) {
-  try {
-    return decode(value);
-  } catch {
-    throw new ErrorClass(`Failed to base64url decode the ${label}`);
-  }
-}
-function encodeBase64url(value, label, ErrorClass) {
-  try {
-    return encode(value);
-  } catch {
-    throw new ErrorClass(`The ${label} is not a valid base64url string`);
-  }
-}
-function parseJoseHeader(b64, ErrorClass, message2) {
-  let parsed;
-  try {
-    parsed = JSON.parse(strictDecoder.decode(decode(b64)));
-  } catch {
-    throw new ErrorClass(message2);
-  }
-  if (!isObject(parsed))
-    throw new ErrorClass(message2);
-  return parsed;
-}
-var JWS_RECOGNIZED = { __proto__: null, b64: true };
-function validateAlgorithms(option, algorithms) {
-  if (algorithms !== void 0 && (!Array.isArray(algorithms) || algorithms.some((s) => typeof s != "string")))
-    throw new TypeError(`"${option}" option must be an array of strings`);
-  return algorithms === void 0 ? void 0 : new Set(algorithms);
-}
-function validateCrit(Err, recognizedDefault, recognizedOption, protectedHeader, joseHeader) {
-  if (joseHeader.crit !== void 0 && protectedHeader?.crit === void 0)
-    throw new Err('"crit" (Critical) Header Parameter MUST be integrity protected');
-  if (!protectedHeader || protectedHeader.crit === void 0)
-    return [];
-  if (!Array.isArray(protectedHeader.crit) || protectedHeader.crit.length === 0 || protectedHeader.crit.some((input) => typeof input != "string" || input.length === 0))
-    throw new Err('"crit" (Critical) Header Parameter MUST be an array of non-empty strings when present');
-  const recognized = recognizedOption === void 0 ? recognizedDefault : { __proto__: null, ...recognizedOption, ...recognizedDefault };
-  for (const parameter of protectedHeader.crit) {
-    if (!(parameter in recognized))
-      throw new JOSENotSupported(`Extension Header Parameter "${parameter}" is not recognized`);
-    if (!Object.hasOwn(joseHeader, parameter) || joseHeader[parameter] === void 0)
-      throw new Err(`Extension Header Parameter "${parameter}" is missing`);
-    if (recognized[parameter] && (!Object.hasOwn(protectedHeader, parameter) || protectedHeader[parameter] === void 0))
-      throw new Err(`Extension Header Parameter "${parameter}" MUST be integrity protected`);
-  }
-  return protectedHeader.crit;
-}
-function validateB64(protectedHeader, extensions) {
-  if (extensions.includes("b64")) {
-    const b64 = protectedHeader.b64;
-    if (typeof b64 != "boolean")
-      throw new JWSInvalid('The "b64" (base64url-encode payload) Header Parameter must be a boolean');
-    return b64;
-  }
-  return true;
-}
-
-// node_modules/.pnpm/jose@6.2.12/node_modules/jose/dist/webapi/lib/key.js
-var tag = (key) => key[Symbol.toStringTag];
-var jwkMatchesOp = (entry, key, usage) => {
-  const { alg } = entry;
-  if (key.use !== void 0) {
-    const expected = usage === "sign" || usage === "verify" ? "sig" : "enc";
-    if (key.use !== expected)
-      throw new TypeError(`Invalid key for this operation, its "use" must be "${expected}" when present`);
-  }
-  if (key.alg !== void 0 && key.alg !== alg)
-    throw new TypeError(`Invalid key for this operation, its "alg" must be "${alg}" when present`);
-  if (Array.isArray(key.key_ops)) {
-    const expectedKeyOp = usage === "encrypt" || usage === "decrypt" ? entry.ops?.[usage === "encrypt" ? 0 : 1] : usage;
-    if (expectedKeyOp && !key.key_ops.includes(expectedKeyOp))
-      throw new TypeError(`Invalid key for this operation, its "key_ops" must include "${expectedKeyOp}" when present`);
-  }
-};
-async function prepareKey(entry, key, usage) {
-  const { alg, secret } = entry, privateKey = usage === "decrypt" || usage === "sign";
-  if (secret && key instanceof Uint8Array)
-    return key;
-  let normalized, keyObject;
-  if (isObject(key)) {
-    if (normalized = normalizeJwk(key), typeof normalized.kty != "string")
-      throw invalidKeyType(alg, key, secret);
-    if (!(secret ? normalized.kty === "oct" && typeof normalized.k == "string" : normalized.kty !== "oct" && (privateKey ? normalized.kty === "AKP" && typeof normalized.priv == "string" || typeof normalized.d == "string" : normalized.d === void 0 && normalized.priv === void 0)))
-      throw new TypeError(secret ? 'JSON Web Key for symmetric algorithms must have JWK "kty" (Key Type) equal to "oct" and the JWK "k" (Key Value) present' : `JSON Web Key for this operation must be a ${privateKey ? "private" : "public"} JWK`);
-    if (jwkMatchesOp(entry, normalized, usage), normalized.kty === "oct")
-      return decode(normalized.k);
-    if (!Object.isFrozen(key)) {
-      const { key_ops } = key;
-      Array.isArray(key_ops) && Object.freeze(key_ops), Object.freeze(key);
-    }
-  } else {
-    if (!isKeyLike(key))
-      throw invalidKeyType(alg, key, secret);
-    const expectedType = secret ? "secret" : privateKey ? "private" : "public";
-    if (key.type !== expectedType && (secret || ["secret", "public", "private"].includes(key.type)))
-      throw new TypeError(`${tag(key)} instances must be of type "${expectedType}" for the ${alg} algorithm`);
-    if (isCryptoKey(key))
-      return key;
-    if (keyObject = key, keyObject.type === "secret")
-      return keyObject.export();
-  }
-  cache ||= /* @__PURE__ */ new WeakMap();
-  const cacheKey = key;
-  let cached = cache.get(cacheKey);
-  if (cached?.[alg])
-    return cached[alg];
-  if (cached || cache.set(cacheKey, cached = {}), keyObject && typeof keyObject.toCryptoKey == "function") {
-    const isPublic = keyObject.type === "public", crv = nist[keyObject.asymmetricKeyDetails?.namedCurve], params = entry.resolve?.({ crv, asymmetricKeyType: keyObject.asymmetricKeyType }) ?? entry.subtle;
-    return cached[alg] = keyObject.toCryptoKey(params, isPublic, entry.usages[isPublic ? 0 : 1]);
-  }
-  return normalized ??= keyObject.export({ format: "jwk" }), normalized.alg = alg, cached[alg] = await jwkToKey(entry, normalized);
-}
-var cache;
-var nist = {
-  __proto__: null,
-  prime256v1: "P-256",
-  secp384r1: "P-384",
-  secp521r1: "P-521"
-};
-var isCryptoKey = (key) => {
-  if (key?.[Symbol.toStringTag] === "CryptoKey")
-    return true;
-  try {
-    return key instanceof CryptoKey;
-  } catch {
-    return false;
-  }
-};
-var isKeyObject = (key) => key?.[Symbol.toStringTag] === "KeyObject";
-var isKeyLike = (key) => isCryptoKey(key) || isKeyObject(key);
-function message(msg, actual, ...types) {
-  if (types.length > 2) {
-    const last = types.pop();
-    msg += `one of type ${types.join(", ")}, or ${last}.`;
-  } else types.length === 2 ? msg += `one of type ${types[0]} or ${types[1]}.` : msg += `of type ${types[0]}.`;
-  return actual == null ? msg += ` Received ${actual}` : typeof actual == "function" && actual.name ? msg += ` Received function ${actual.name}` : typeof actual == "object" && actual != null && actual.constructor?.name && (msg += ` Received an instance of ${actual.constructor.name}`), msg;
-}
-function invalidKeyType(alg, actual, secret) {
-  const types = ["CryptoKey", "KeyObject", "JSON Web Key"];
-  return secret && types.push("Uint8Array"), new TypeError(message(`Key for the ${alg} algorithm must be `, actual, ...types));
-}
-var unusable = (name, prop = "algorithm.name") => new TypeError(`CryptoKey does not support this operation, its ${prop} must be ${name}`);
-function checkUsage(key, usage) {
-  if (usage && !key.usages.includes(usage))
-    throw new TypeError(`CryptoKey does not support this operation, its usages must include ${usage}.`);
-}
-function checkModulusLength(alg, key) {
-  const { modulusLength } = key.algorithm;
-  if (typeof modulusLength != "number" || modulusLength < 2048)
-    throw new TypeError(`${alg} requires key modulusLength to be 2048 bits or larger`);
-}
-function checkCryptoKey(key, expected, usage) {
-  const algorithm = key.algorithm;
-  if (algorithm.name !== expected.name)
-    throw unusable(expected.name);
-  if (expected.hash && algorithm.hash?.name !== expected.hash)
-    throw unusable(expected.hash, "algorithm.hash");
-  if (expected.namedCurve && algorithm.namedCurve !== expected.namedCurve)
-    throw unusable(expected.namedCurve, "algorithm.namedCurve");
-  if (expected.length !== void 0 && algorithm.length !== expected.length)
-    throw unusable(expected.length, "algorithm.length");
-  checkUsage(key, usage);
-}
-function snapshotJwk(jwk) {
-  return { __proto__: null, ...jwk };
-}
-function normalizeJwk(jwk) {
-  const normalized = snapshotJwk(jwk);
-  if (normalized.ext !== void 0 && typeof normalized.ext != "boolean")
-    throw new TypeError('"ext" (Extractable) Parameter must be a boolean');
-  if (normalized.key_ops !== void 0) {
-    const value = normalized.key_ops, keyOps = Array.isArray(value) ? [...value] : void 0;
-    if (!keyOps || keyOps.some((operation) => typeof operation != "string") || new Set(keyOps).size !== keyOps.length)
-      throw new TypeError('"key_ops" (Key Operations) Parameter must be an array of unique strings');
-    normalized.key_ops = keyOps;
-  }
-  return normalized;
-}
-async function jwkToKey(entry, jwk, extractable) {
-  if (!entry.kty.includes(jwk.kty))
-    throw new JOSENotSupported('Invalid or unsupported JWK "alg" (Algorithm) Parameter value');
-  const algorithm = entry.resolve?.({ kty: jwk.kty, crv: jwk.crv }) ?? entry.subtle, isPrivate = !!(jwk.d || jwk.priv), keyData = { ...jwk, ext: extractable ?? jwk.ext };
-  return keyData.kty !== "AKP" && delete keyData.alg, delete keyData.use, crypto.subtle.importKey("jwk", keyData, algorithm, keyData.ext ?? !isPrivate, jwk.key_ops ?? entry.usages[isPrivate ? 1 : 0]);
-}
-async function rawKey(key, expected, usage, extractable = false) {
-  return key instanceof Uint8Array && (key = await crypto.subtle.importKey("raw", key, expected, extractable, [usage])), checkCryptoKey(key, expected, usage), key;
-}
-
-// node_modules/.pnpm/jose@6.2.12/node_modules/jose/dist/webapi/lib/key_descriptor.js
-function table(entries) {
-  const out = { __proto__: null };
-  for (const alg in entries)
-    out[alg] = { ...entries[alg], alg };
-  return out;
-}
-
-// node_modules/.pnpm/jose@6.2.12/node_modules/jose/dist/webapi/lib/jws_algorithms.js
-var sig = [["verify"], ["sign"]];
-function hmac(bits) {
-  const subtle = { name: "HMAC", hash: `SHA-${bits}` };
-  return { kty: ["oct"], secret: true, subtle, signing: subtle, usages: sig };
-}
-function rsa(bits, saltLength) {
-  const subtle = { name: saltLength ? "RSA-PSS" : "RSASSA-PKCS1-v1_5", hash: `SHA-${bits}` };
-  return {
-    kty: ["RSA"],
-    subtle,
-    signing: saltLength ? { ...subtle, saltLength } : subtle,
-    usages: sig,
-    minRsaBits: 2048
-  };
-}
-function ecdsa(crv, bits) {
-  return {
-    kty: ["EC"],
-    crv,
-    subtle: { name: "ECDSA", namedCurve: crv },
-    signing: { name: "ECDSA", hash: `SHA-${bits}` },
-    usages: sig
-  };
-}
-function eddsa() {
-  const subtle = { name: "Ed25519" };
-  return {
-    kty: ["OKP"],
-    crv: "Ed25519",
-    subtle,
-    signing: subtle,
-    usages: sig
-  };
-}
-function mldsa(bits) {
-  const subtle = { name: `ML-DSA-${bits}` };
-  return {
-    kty: ["AKP"],
-    subtle,
-    signing: subtle,
-    usages: sig
-  };
-}
-var JWS = table({
-  HS256: hmac(256),
-  HS384: hmac(384),
-  HS512: hmac(512),
-  RS256: rsa(256),
-  RS384: rsa(384),
-  RS512: rsa(512),
-  PS256: rsa(256, 32),
-  PS384: rsa(384, 48),
-  PS512: rsa(512, 64),
-  ES256: ecdsa("P-256", 256),
-  ES384: ecdsa("P-384", 384),
-  ES512: ecdsa("P-521", 512),
-  EdDSA: eddsa(),
-  Ed25519: eddsa(),
-  "ML-DSA-44": mldsa(44),
-  "ML-DSA-65": mldsa(65),
-  "ML-DSA-87": mldsa(87)
-});
-function jwsAlgorithm(alg) {
-  const entry = typeof alg == "string" ? JWS[alg] : void 0;
-  if (!entry)
-    throw new JOSENotSupported(`alg ${alg} is not supported either by JOSE or your javascript runtime`);
-  return entry;
-}
-
-// node_modules/.pnpm/jose@6.2.12/node_modules/jose/dist/webapi/lib/jws_verify.js
-function prepareVerify(options) {
-  return [options && validateAlgorithms("algorithms", options.algorithms), options?.crit];
-}
-function parseProtectedHeader(encodedProtected) {
-  return encodedProtected === void 0 ? {} : parseJoseHeader(encodedProtected, JWSInvalid, "JWS Protected Header is invalid");
-}
-function encodeCompactUnencodedPayload(payload) {
-  try {
-    return encode(payload);
-  } catch {
-    throw new JWSInvalid("JWS Compact Serialization payload must use only ASCII characters");
-  }
-}
-async function verifySignature(jws, shared, key, encodeUnencodedPayload, parsedProtected) {
-  const { protected: encodedProtected, header, payload: inputPayload } = jws, parsedProt = parsedProtected ?? parseProtectedHeader(encodedProtected);
-  if (!isDisjoint(parsedProt, header))
-    throw new JWSInvalid("JWS Protected and JWS Unprotected Header Parameter names must be disjoint");
-  const joseHeader = { ...parsedProt, ...header }, b64 = validateB64(parsedProt, validateCrit(JWSInvalid, JWS_RECOGNIZED, shared[1], parsedProt, joseHeader)), { alg } = joseHeader;
-  if (typeof alg != "string" || !alg)
-    throw new JWSInvalid('JWS "alg" (Algorithm) Header Parameter missing or invalid');
-  if (shared[0] && !shared[0].has(alg))
-    throw new JOSEAlgNotAllowed('"alg" (Algorithm) Header Parameter value not allowed');
-  if (b64) {
-    if (typeof inputPayload != "string")
-      throw new JWSInvalid("JWS Payload must be a string");
-  } else if (typeof inputPayload != "string" && !(inputPayload instanceof Uint8Array))
-    throw new JWSInvalid("JWS Payload must be a string or an Uint8Array instance");
-  const signingPayload = b64 || typeof inputPayload != "string" ? inputPayload : encodeUnencodedPayload(inputPayload);
-  let resolvedKey = false;
-  typeof key == "function" && (key = await key(parsedProt, jws), resolvedKey = true);
-  const entry = jwsAlgorithm(alg), data = concat(encodedProtected !== void 0 ? encode(encodedProtected) : new Uint8Array(), encode("."), typeof signingPayload == "string" ? shared[2] ??= encodeBase64url(signingPayload, "payload", JWSInvalid) : signingPayload), signature = decodeBase64url(jws.signature, "signature", JWSInvalid), k = await prepareKey(entry, key, "verify"), cryptoKey = await rawKey(k, entry.subtle, "verify");
-  entry.minRsaBits && checkModulusLength(entry.alg, cryptoKey);
-  let verified = false;
-  try {
-    verified = await crypto.subtle.verify(entry.signing, cryptoKey, signature, data);
-  } catch {
-  }
-  if (!verified)
-    throw new JWSSignatureVerificationFailed();
-  const result = { payload: typeof signingPayload == "string" ? decodeBase64url(signingPayload, "payload", JWSInvalid) : signingPayload };
-  return encodedProtected !== void 0 && (result.protectedHeader = parsedProt), header !== void 0 && (result.unprotectedHeader = header), resolvedKey ? [{ ...result, key: k }, b64] : [result, b64];
-}
-async function verifyCompact(jws, shared, key) {
-  if (jws instanceof Uint8Array && (jws = decoder.decode(jws)), typeof jws != "string")
-    throw new JWSInvalid("Compact JWS must be a string or Uint8Array");
-  const { 0: protectedHeader, 1: payload, 2: signature, length } = jws.split(".");
-  if (length !== 3)
-    throw new JWSInvalid("Invalid Compact JWS");
-  return verifySignature({ payload, protected: protectedHeader, signature }, shared, key, encodeCompactUnencodedPayload);
-}
-
-// node_modules/.pnpm/jose@6.2.12/node_modules/jose/dist/webapi/lib/jwt_claims_set.js
-var epoch = (date) => Math.floor(date.getTime() / 1e3);
-var multipliers = {
-  s: 1,
-  m: 60,
-  h: 3600,
-  d: 86400,
-  w: 604800,
-  y: 31557600
-};
-var REGEX = /^(\+|\-)? ?(\d+|\d+\.\d+) ?(seconds?|secs?|s|minutes?|mins?|m|hours?|hrs?|h|days?|d|weeks?|w|years?|yrs?|y)(?: (ago|from now))?$/i;
-var checkFailed = "check_failed";
-function invalidDuration() {
-  throw new TypeError("Invalid time period format");
-}
-function secs(str) {
-  typeof str != "string" && invalidDuration();
-  const matched = REGEX.exec(str);
-  (!matched || matched[4] && matched[1]) && invalidDuration();
-  const value = parseFloat(matched[2]), numericDate2 = Math.round(value * multipliers[matched[3][0].toLowerCase()]);
-  return Number.isFinite(numericDate2) || invalidDuration(), matched[1] === "-" || matched[4] === "ago" ? -numericDate2 : numericDate2;
-}
-function validateInput(label, input) {
-  if (!Number.isFinite(input))
-    throw new TypeError(`Invalid ${label} input`);
-  return input;
-}
-var normalizeTyp = (value) => {
-  const normalized = value.toLowerCase();
-  return value.includes("/") ? normalized : `application/${normalized}`;
-};
-var checkAudiencePresence = (audPayload, audOption) => typeof audPayload == "string" ? audOption.includes(audPayload) : Array.isArray(audPayload) ? audOption.some((aud) => audPayload.includes(aud)) : false;
-function validateNumericDate(payload, claim, required = false) {
-  const value = payload[claim];
-  if (!(value === void 0 && !required)) {
-    if (typeof value != "number")
-      throw new JWTClaimValidationFailed(`"${claim}" claim must be a number`, payload, claim, "invalid");
-    return value;
-  }
-}
-function unexpectedClaim(payload, claim) {
-  throw new JWTClaimValidationFailed(`unexpected "${claim}" claim value`, payload, claim, checkFailed);
-}
-function validateClaimsSet(protectedHeader, encodedPayload, options = {}) {
-  let payload;
-  try {
-    payload = JSON.parse(strictDecoder.decode(encodedPayload));
-  } catch {
-  }
-  if (!isObject(payload))
-    throw new JWTInvalid("JWT Claims Set must be a top-level JSON object");
-  const { typ } = options;
-  if (typ !== void 0 && (typeof protectedHeader.typ != "string" || normalizeTyp(protectedHeader.typ) !== normalizeTyp(typ)))
-    throw new JWTClaimValidationFailed('unexpected "typ" JWT header value', payload, "typ", checkFailed);
-  const { requiredClaims = [], issuer, subject, audience, maxTokenAge } = options, presenceCheck = [...requiredClaims];
-  maxTokenAge !== void 0 && presenceCheck.push("iat"), audience !== void 0 && presenceCheck.push("aud"), subject !== void 0 && presenceCheck.push("sub"), issuer !== void 0 && presenceCheck.push("iss");
-  for (const claim of new Set(presenceCheck.reverse()))
-    if (!Object.hasOwn(payload, claim))
-      throw new JWTClaimValidationFailed(`missing required "${claim}" claim`, payload, claim, "missing");
-  issuer !== void 0 && !(Array.isArray(issuer) ? issuer : [issuer]).includes(payload.iss) && unexpectedClaim(payload, "iss"), subject !== void 0 && payload.sub !== subject && unexpectedClaim(payload, "sub"), audience !== void 0 && !checkAudiencePresence(payload.aud, typeof audience == "string" ? [audience] : audience) && unexpectedClaim(payload, "aud");
-  const { clockTolerance } = options;
-  let tolerance = 0;
-  if (typeof clockTolerance == "string")
-    tolerance = secs(clockTolerance);
-  else if (clockTolerance !== void 0) {
-    if (typeof clockTolerance != "number")
-      throw new TypeError("Invalid clockTolerance option type");
-    tolerance = clockTolerance;
-  }
-  validateInput("clockTolerance option", tolerance);
-  const { currentDate } = options, now = validateInput("currentDate option", epoch(currentDate === void 0 ? /* @__PURE__ */ new Date() : currentDate)), iat = validateNumericDate(payload, "iat", maxTokenAge !== void 0), nbf = validateNumericDate(payload, "nbf");
-  if (nbf !== void 0 && nbf > now + tolerance)
-    throw new JWTClaimValidationFailed('"nbf" claim timestamp check failed', payload, "nbf", checkFailed);
-  const exp = validateNumericDate(payload, "exp");
-  if (exp !== void 0 && exp <= now - tolerance)
-    throw new JWTExpired('"exp" claim timestamp check failed', payload, "exp", checkFailed);
-  if (maxTokenAge !== void 0) {
-    const age = now - iat, max = validateInput("maxTokenAge option", typeof maxTokenAge == "number" ? maxTokenAge : secs(maxTokenAge));
-    if (age - tolerance > max)
-      throw new JWTExpired('"iat" claim timestamp check failed (too far in the past)', payload, "iat", checkFailed);
-    if (age < -tolerance)
-      throw new JWTClaimValidationFailed('"iat" claim timestamp check failed (it should be in the past)', payload, "iat", checkFailed);
-  }
-  return payload;
-}
-
-// node_modules/.pnpm/jose@6.2.12/node_modules/jose/dist/webapi/jwt/verify.js
-async function jwtVerify(jwt, key, options) {
-  const [verified, b64] = await verifyCompact(jwt, prepareVerify(options), key);
-  if (!b64)
-    throw new JWTInvalid("JWTs MUST NOT use unencoded payload");
-  const payload = validateClaimsSet(verified.protectedHeader, verified.payload, options);
-  return { ...verified, payload };
-}
-
-// node_modules/.pnpm/jose@6.2.12/node_modules/jose/dist/webapi/jwks/local.js
-function isUsableJWK(jwk, entry, alg, kid) {
-  const { kty, key_ops: keyOps, ext, kid: jwkKid, alg: jwkAlg, use, crv } = jwk;
-  return (ext === void 0 || typeof ext == "boolean") && (keyOps === void 0 || Array.isArray(keyOps) && keyOps.every((operation, index) => typeof operation == "string" && keyOps.indexOf(operation) === index) && keyOps.includes("verify")) && entry.kty.includes(kty) && (kid === void 0 || typeof kid == "string" && kid === jwkKid) && (jwkAlg === void 0 ? kty !== "AKP" : alg === jwkAlg) && (use === void 0 || use === "sig") && (!entry.crv || crv === entry.crv);
-}
-async function importWithAlgCache(cache2, jwk, entry) {
-  const cached = cache2.get(jwk) || cache2.set(jwk, {}).get(jwk), { alg } = entry;
-  if (cached[alg] === void 0) {
-    const pending = jwkToKey(entry, jwk, true).then((key) => {
-      if (key.type !== "public")
-        throw new JWKSInvalid("JSON Web Key Set members must be public keys");
-      return cached[alg] = key, key;
-    }).catch((error2) => {
-      throw cached[alg] === pending && delete cached[alg], error2;
-    });
-    cached[alg] = pending;
-  }
-  return cached[alg];
-}
-function createLocalJWKSet(jwks) {
-  let snapshot;
-  try {
-    snapshot = structuredClone(jwks);
-  } catch {
-  }
-  if (!isJwkSet(snapshot))
-    throw new JWKSInvalid("JSON Web Key Set malformed");
-  const metadata = snapshot.keys.map((jwk) => {
-    const normalized = snapshotJwk(jwk);
-    return Array.isArray(normalized.key_ops) && (normalized.key_ops = [...normalized.key_ops]), normalized;
-  }), cached = /* @__PURE__ */ new WeakMap();
-  return Object.defineProperty(async (protectedHeader, token) => {
-    const { alg, kid } = { ...protectedHeader, ...token?.header }, entry = typeof alg == "string" ? JWS[alg] : void 0;
-    if (!entry || entry.secret)
-      throw new JOSENotSupported('Unsupported "alg" value for a JSON Web Key Set');
-    const candidates = snapshot.keys.filter((_, index) => isUsableJWK(metadata[index], entry, alg, kid)), { 0: jwk, length } = candidates;
-    if (!length)
-      throw new JWKSNoMatchingKey();
-    if (length !== 1) {
-      const error2 = new JWKSMultipleMatchingKeys();
-      throw error2[Symbol.asyncIterator] = async function* () {
-        for (const jwk2 of candidates)
-          try {
-            yield await importWithAlgCache(cached, jwk2, entry);
-          } catch {
-          }
-      }, error2;
-    }
-    return importWithAlgCache(cached, jwk, entry);
-  }, "jwks", {
-    value: () => structuredClone(snapshot)
-  });
-}
-
-// node_modules/.pnpm/jose@6.2.12/node_modules/jose/dist/webapi/jwks/remote.js
-function isCloudflareWorkers() {
-  return typeof WebSocketPair < "u" || typeof navigator < "u" && navigator.userAgent === "Cloudflare-Workers" || typeof EdgeRuntime < "u" && EdgeRuntime === "vercel";
-}
-var USER_AGENT;
-(typeof navigator > "u" || !navigator.userAgent?.startsWith?.("Mozilla/5.0 ")) && (USER_AGENT = "jose/v6.2.12");
-var customFetch = /* @__PURE__ */ Symbol();
-async function fetchJwks(url, headers, signal, fetchImpl = fetch) {
-  const response = await fetchImpl(url, {
-    method: "GET",
-    signal,
-    redirect: "manual",
-    headers
-  }).catch((err) => {
-    throw err.name === "TimeoutError" ? new JWKSTimeout() : err;
-  });
-  if (response.status !== 200)
-    throw new JOSEError("Expected 200 OK from the JSON Web Key Set HTTP response");
-  try {
-    return await response.json();
-  } catch {
-    throw new JOSEError("Failed to parse the JSON Web Key Set HTTP response as JSON");
-  }
-}
-var jwksCache = /* @__PURE__ */ Symbol();
-function isFreshFor(timestamp, duration) {
-  return Number.isFinite(timestamp) && Date.now() < timestamp + duration;
-}
-function validateDuration(value, fallback, option) {
-  if (Number.isNaN(value))
-    throw new TypeError(`"${option}" option must not be NaN`);
-  return typeof value == "number" ? value : fallback;
-}
-function createRemoteJWKSet(url, options) {
-  if (!(url instanceof URL))
-    throw new TypeError("url must be an instance of URL");
-  const href = new URL(url.href).href, opts = options ?? {}, timeoutOption = opts.timeoutDuration;
-  if (typeof timeoutOption == "number" && (!Number.isInteger(timeoutOption) || timeoutOption < 0))
-    throw new TypeError('"timeoutDuration" option must be a non-negative integer');
-  const timeoutDuration = typeof timeoutOption == "number" ? timeoutOption : 5e3, cooldownDuration = validateDuration(opts.cooldownDuration, 3e4, "cooldownDuration"), cacheMaxAge = validateDuration(opts.cacheMaxAge, 6e5, "cacheMaxAge"), headers = new Headers(opts.headers);
-  USER_AGENT && !headers.has("User-Agent") && headers.set("User-Agent", USER_AGENT), headers.has("accept") || headers.set("accept", "application/json, application/jwk-set+json");
-  const fetchImpl = opts[customFetch], cache2 = opts[jwksCache];
-  let jwksTimestamp, pendingFetch, reloadSequence = 0, appliedSequence = 0, local;
-  if (cache2 && typeof cache2 == "object") {
-    const { uat, jwks } = cache2;
-    isFreshFor(uat, cacheMaxAge) && isJwkSet(jwks) && (jwksTimestamp = uat, local = createLocalJWKSet(jwks));
-  }
-  const reload = async () => {
-    if (pendingFetch && isCloudflareWorkers() && (pendingFetch = void 0), !pendingFetch) {
-      const sequence = ++reloadSequence, current = pendingFetch = fetchJwks(href, headers, AbortSignal.timeout(timeoutDuration), fetchImpl).then((json3) => {
-        const next = createLocalJWKSet(json3);
-        if (sequence <= appliedSequence)
-          return;
-        local = next;
-        const updatedAt = Date.now();
-        cache2 && (cache2.uat = updatedAt, cache2.jwks = json3), jwksTimestamp = updatedAt, appliedSequence = sequence;
-      }).finally(() => {
-        pendingFetch === current && (pendingFetch = void 0);
-      });
-    }
-    await pendingFetch;
-  };
-  return Object.defineProperties(async (protectedHeader, token) => {
-    (!local || !isFreshFor(jwksTimestamp, cacheMaxAge)) && await reload();
-    try {
-      return await local(protectedHeader, token);
-    } catch (err) {
-      if (err instanceof JWKSNoMatchingKey && !isFreshFor(jwksTimestamp, cooldownDuration))
-        return await reload(), local(protectedHeader, token);
-      throw err;
-    }
-  }, {
-    coolingDown: {
-      get: () => isFreshFor(jwksTimestamp, cooldownDuration),
-      enumerable: true
-    },
-    fresh: {
-      get: () => isFreshFor(jwksTimestamp, cacheMaxAge),
-      enumerable: true
-    },
-    reload: {
-      value: reload,
-      enumerable: true
-    },
-    reloading: {
-      get: () => !!pendingFetch,
-      enumerable: true
-    },
-    jwks: {
-      value: () => local?.jwks(),
-      enumerable: true
-    }
-  });
-}
-
-// packages/cli/src/web/team-auth.ts
 var scrypt = promisify(scryptCallback);
 var COOKIE = "zero_team_session";
 var SSO_COOKIE = "zero_team_sso";
@@ -2329,8 +1621,8 @@ function parseTeamConfig(input) {
   return configSchema.parse(input);
 }
 var TeamAuthError = class extends Error {
-  constructor(message2, statusCode = 401) {
-    super(message2);
+  constructor(message, statusCode = 401) {
+    super(message);
     this.statusCode = statusCode;
   }
   statusCode;
@@ -2538,8 +1830,8 @@ var TeamAuth = class {
 
 // packages/cli/src/web/findings-access-tokens.ts
 var FindingsAccessError = class extends Error {
-  constructor(message2, statusCode = 400) {
-    super(message2);
+  constructor(message, statusCode = 400) {
+    super(message);
     this.statusCode = statusCode;
     this.name = "FindingsAccessError";
   }
@@ -2851,8 +2143,8 @@ import { constants as constants2, closeSync as closeSync2, fstatSync as fstatSyn
 import { join as join2, resolve as resolve2 } from "node:path";
 import { homedir as homedir2 } from "node:os";
 var SkillsError = class extends Error {
-  constructor(message2, statusCode = 400) {
-    super(message2);
+  constructor(message, statusCode = 400) {
+    super(message);
     this.statusCode = statusCode;
   }
   statusCode;
@@ -3203,8 +2495,8 @@ import { createHash as createHash5, randomUUID as randomUUID5 } from "node:crypt
 import { closeSync as closeSync3, constants as constants3, fstatSync as fstatSync3, mkdirSync as mkdirSync3, openSync as openSync3, readFileSync as readFileSync4, realpathSync as realpathSync3, renameSync as renameSync3, unlinkSync as unlinkSync3, writeFileSync as writeFileSync3 } from "node:fs";
 import { join as join3 } from "node:path";
 var EngagementError = class extends Error {
-  constructor(message2, statusCode = 400) {
-    super(message2);
+  constructor(message, statusCode = 400) {
+    super(message);
     this.statusCode = statusCode;
     this.name = "EngagementError";
   }
@@ -3611,8 +2903,8 @@ var WorkflowTriggerService = class {
     this.#workflows.close();
   }
 };
-function error(status, message2) {
-  return { status, data: { error: message2 } };
+function error(status, message) {
+  return { status, data: { error: message } };
 }
 function isProcessAlive(pid) {
   try {
@@ -3733,6 +3025,7 @@ async function createWorkspaceServices(options) {
   const skills = new SkillsStore({ workspace: options.workspace ?? process.cwd(), stateDir: options.stateDir ?? homeStateDir(), team: options.auth.enabled });
   const remoteProviderRelays = new RemoteProviderRelayBroker({ epoch: options.relayEpoch ?? randomUUID6() });
   const gateway = new ConsoleGateway({
+    allowChatGptPlan: !options.auth.enabled,
     remoteProviderRelays,
     dbPath: options.dbPath,
     projectPath: options.workspace,
@@ -3744,7 +3037,7 @@ async function createWorkspaceServices(options) {
     ...options.stateDir ? { homeDir: options.stateDir } : {}
   });
   const engagements = new EngagementStore({ workspace: options.workspace ?? process.cwd(), dbPath: options.dbPath, ...options.stateDir ? { stateDir: options.stateDir } : {} });
-  const operator = new WebOperatorServices({ isTurnActive: () => gateway.hasActiveTurns() });
+  const operator = new WebOperatorServices({ allowChatGptPlan: !options.auth.enabled, isTurnActive: () => gateway.hasActiveTurns() });
   let workflows;
   let engine;
   let triggers;
@@ -3974,8 +3267,8 @@ import { createHash as createHash7, randomUUID as randomUUID8 } from "node:crypt
 import { closeSync as closeSync5, constants as constants5, fstatSync as fstatSync5, mkdirSync as mkdirSync5, openSync as openSync5, readFileSync as readFileSync6, renameSync as renameSync5, unlinkSync as unlinkSync5, writeFileSync as writeFileSync5 } from "node:fs";
 import { join as join5 } from "node:path";
 var CollaborationError = class extends Error {
-  constructor(message2, statusCode = 400) {
-    super(message2);
+  constructor(message, statusCode = 400) {
+    super(message);
     this.statusCode = statusCode;
     this.name = "CollaborationError";
   }
@@ -4630,8 +3923,8 @@ function discoverSshHosts(configPath = join6(homedir3(), ".ssh", "config")) {
 
 // packages/cli/src/commands/dashboard.ts
 var WebRequestError = class extends Error {
-  constructor(message2, statusCode) {
-    super(message2);
+  constructor(message, statusCode) {
+    super(message);
     this.statusCode = statusCode;
   }
   statusCode;
@@ -5351,7 +4644,11 @@ function resolveDashboardAssetDir(explicitAssetDir) {
   }
   const embedded = materializeEmbeddedDashboardAssets(DASHBOARD_ASSETS);
   if (embedded) return embedded;
+  const checkoutPackage = resolve4(moduleDir, "..", "..");
   for (const candidate of [
+    // A source-built CLI can run from a different project directory. Resolve
+    // its sibling app from the checkout, never from an unrelated installed CLI.
+    ...existsSync2(join7(checkoutPackage, "src", "index.ts")) ? [join7(checkoutPackage, "..", "dashboard", "dist")] : [],
     join7(process.cwd(), "packages", "dashboard", "dist"),
     join7(process.cwd(), "dist", "dashboard")
   ]) {
@@ -5394,7 +4691,7 @@ async function handleWebConsoleApiRequest(req, res, requestUrl, gateway, operato
   const input = method === "GET" || method === "HEAD" ? void 0 : await readJson(req);
   const member = team?.auth.resolveSession(req);
   const author = member ? { userId: member.userId, displayName: member.displayName } : void 0;
-  if (team && method !== "GET" && method !== "HEAD") {
+  if (team?.auth.enabled && method !== "GET" && method !== "HEAD") {
     const readResume = /^saved\/[^/]+\/resume$/.test(path) && input !== null && typeof input === "object" && Object.keys(input).length === 0;
     if (/^saved\/[^/]+\/resume$/.test(path) && team.auth.resolveSession(req)?.role !== "owner" && !readResume) throw new WebRequestError("Only workspace owners can override a saved conversation's configuration.", 403);
     const liveId = /^sessions\/([^/]+)/.exec(path)?.[1];
@@ -5504,8 +4801,8 @@ async function handleWebConsoleApiRequest(req, res, requestUrl, gateway, operato
     } else if (action === "events" && method === "GET") {
       json2(res, 200, gateway.eventsAfter(id2, consoleEventsAfter(requestUrl.searchParams.get("after"))));
     } else if (action === "messages" && method === "POST") {
-      const message2 = author && input && typeof input === "object" && !("workerId" in input) && (!("mode" in input) || input.mode === "send") ? { ...input, mode: "queue" } : input;
-      const { queuedMessageId, ...session } = await gateway.send(id2, message2, author);
+      const message = author && input && typeof input === "object" && !("workerId" in input) && (!("mode" in input) || input.mode === "send") ? { ...input, mode: "queue" } : input;
+      const { queuedMessageId, ...session } = await gateway.send(id2, message, author);
       json2(res, 202, { session, ...queuedMessageId ? { queuedMessageId } : {} });
     } else if (action === "cancel" && method === "POST") json2(res, 200, { session: await gateway.cancel(id2) });
     else if (action === "connection" && parts[3] === "reload" && parts.length === 4 && method === "POST") {
@@ -5574,7 +4871,7 @@ data: ${JSON.stringify(event)}
 `);
 }
 async function handleApiRequest(req, res, pathname, dbPath, controlToken, engineBearer) {
-  const { osecDB: osecDB2 } = await import("./dist-OLGNKDB2.js");
+  const { osecDB: osecDB2 } = await import("./dist-QLMPTFT7.js");
   if (isPresentationEventsStreamPath(pathname)) {
     if (req.method !== "GET") {
       json2(res, 405, { error: "Method not allowed" });
@@ -5628,7 +4925,7 @@ async function handleApiRequest(req, res, pathname, dbPath, controlToken, engine
       return true;
     }
     if (controlPath.action === "recover-stale-workers") {
-      const { recoverStaleWorkers } = await import("./orchestrate-Z3DW265M.js");
+      const { recoverStaleWorkers } = await import("./orchestrate-ZF6ZTSIQ.js");
       const body = await readJson(req);
       const recovered = recoverStaleWorkers(
         dbPath,
@@ -5675,8 +4972,8 @@ async function handleApiRequest(req, res, pathname, dbPath, controlToken, engine
       return true;
     }
     if (controlPath.action === "reset-database") {
-      const { resetOsecDatabase } = await import("./dist-OLGNKDB2.js");
-      const { seedVerificationWorkbench } = await import("./db-R2AQSESC.js");
+      const { resetOsecDatabase } = await import("./dist-QLMPTFT7.js");
+      const { seedVerificationWorkbench } = await import("./db-FU3OIGQK.js");
       const body = await readJson(req);
       const seed = typeof body.seed === "string" ? body.seed.trim().toLowerCase() : "verification";
       if (!["verification", "empty"].includes(seed)) {